CVE-2021-28382

Zoho ManageEngine Key Manager Plus (before 6001) exposes a Stored XSS vulnerability on the user-management page when importing malicious user details from Active Directory. Affects the product in versions prior to 6001. Remediation: upgrade to version 6001 or later per release notes.

CVE-2021-28382

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD...

Zoho ManageEngine Key Manager Plus 6001 跨站脚本漏洞

ZOHO ManageEngine Key Manager Plus is a WEB-based SSH key management solution from ZOHO that helps you harden, control, manage, monitor and audit SSH keys across the entire lifecycle of a secret key. It provides administrators with visual SSH management capabilities to help them effectively contr...

Security Bulletin: Vulnerability in GNU gettext affects IBM Spectrum Protect Plus (CVE-2018-18751)

Summary Denial of service vulnerability in GNU gettext may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2018-18751 DESCRIPTION: GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the defaultaddmessage function in read-catalog.c. By persuading a...

Hundred Plus 101EIP system cross-site scripting vulnerability

Hundred Plus 101EIP system is a cloud-based office platform of Taiwan Hundred Plus Corporation Hundred Plus, which is the result of the experience of many enterprises. A cross-site scripting vulnerability exists in the Hundred Plus 101EIP system, which originates from the system adding a bulletin...

The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)

The theplusmorepost AJAX action of the plugin did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting exploitable on both unauthenticated and authenticated users PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

CVE-2021-32540 Hundred Plus 101EIP - Stored XSS-2

Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack...

Cesanta MJS 缓冲区错误漏洞

Cesanta MJS is an embedded JavaScript engine for C/C++, designed for microcontrollers with limited resources. A stack overflow vulnerability exists in parseplusminus in Cesanta MJS version 1.20.1. An attacker can exploit this vulnerability via specially crafted files to cause a denial of service...

Hundred Plus 101EIP 跨站脚本漏洞

The Hundred Plus 101EIP system is a cloud-based office platform from Taiwan-based Hundred Plus Corporation Hundred Plus that has been optimized by gathering the experience of many enterprises. 101EIP suffers from a cross-site scripting vulnerability that stems from the calendar add event feature...

Hundred Plus 101EIP system 跨站脚本漏洞

Hundred Plus 101EIP system is a cloud-based office platform of Taiwan Hundred Plus Corporation Hundred Plus, which is the result of the experience of many enterprises. A cross-site scripting vulnerability exists in the Hundred Plus 101EIP system, which originates from the system adding a bulletin...

The vulnerability of Intel Falcon 8+ UAS AscTec Thermal Viewer lies in errors during resolution saving, which allows attackers to escalate their privileges.

The vulnerability of Intel Falcon 8+ UAS AscTec Thermal Viewer relates to errors during resolution saving. Exploiting this vulnerability can allow attackers to enhance their privileges...

Zoho ManageEngine ADSelfService Plus Cross-Site Scripting Vulnerability (CNVD-2021-37588)

ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlock, profile information update, etc. without relying on a help desk. A stored cross-site scripting vulnerability exists in the...

Unspecified vulnerability in WordPress plugin

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A security vulnerability exists in the Store Locator Plus...

CVE-2021-27956

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...

Cross site scripting

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...

CVE-2021-27956

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...

CVE-2021-27956

CVE-2021-27956 affects Zoho ManageEngine ADSelfService Plus prior to version 6104. The vulnerability is a stored XSS in the /webclient/index.html#/directory-search user search page, exploitable via the e-mail address field. Root cause is unsanitized input stored on the page that allows injection ...

CVE-2021-27956

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...

ZOHO zoho manageengine adselfservice plus 跨站脚本漏洞

ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlock, profile information update, etc. without relying on a help desk. A stored cross-site scripting vulnerability exists in the...

ManageEngine ADSelfService Plus 6.1 - CSV Injection Exploit

Exploit Title: ManageEngine ADSelfService Plus 6.1 - CSV Injection Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.manageengine.com/ Software Link: https://www.manageengine.com/products/self-service-password/download.html Version: 6.1 Description:...